Examkin

Soru

Zorluk: ZorAzure Policy Governance

An enterprise is designing a governance strategy for its Azure environment. The resource hierarchy consists of a root management group with two child management groups: MG-Production and MG-Development. You must implement Azure Policies to enforce compliance according to the following requirements:

- All virtual machines deployed in MG-Production must have Azure Backup enabled automatically. If a VM is deployed without backup configured, Azure Backup must be configured automatically.
- To control costs, any attempt to deploy virtual machines outside of the Dv3-series in MG-Development must be blocked immediately.
- A specific resource group named rg-legacy within MG-Production hosts legacy workloads and must be exempted from the backup requirement.
- Existing and new SQL databases in MG-Production must be monitored for SQL auditing configuration, but deployments must not be blocked or auto-remediated.

You need to design the Azure Policy solution to meet these requirements with the least administrative overhead. Which two of the following policy assignments should you recommend? (Select TWO.)

  1. Assign a policy containing a DeployIfNotExists effect for virtual machine backup to the MG-Production management group, and add the rg-legacy resource group to the notScopes property of the assignment.Cevap
  2. Assign a policy containing a Deny effect for allowed VM SKUs to MG-Development, and assign a policy containing an Audit effect for SQL database auditing to MG-Production.Cevap
  3. C
    Assign a policy containing a Deny effect for virtual machine backup to MG-Production, and configure a manual remediation task for virtual machines deployed in rg-legacy.
  4. D
    Assign a policy containing a Modify effect for virtual machine backup to the root management group, and configure Azure RBAC Deny assignments to exclude the users deploying to rg-legacy from the policy.

Cevap

Assign a policy containing a DeployIfNotExists effect for virtual machine backup to the MG-Production management group with the rg-legacy resource group in the notScopes property, and assign a Deny policy for VM SKUs to MG-Development alongside an Audit policy for SQL auditing to MG-Production.
The correct strategy uses DeployIfNotExists to automatically deploy dependent backup configurations for virtual machines within MG-Production, utilizing the notScopes property to cleanly exclude rg-legacy. It also applies a Deny policy to MG-Development to block non-Dv3 VM sizes immediately, and an Audit policy to MG-Production to monitor SQL database auditing configuration without altering or blocking resources.

Adım Adım Çözüm

1
Determine the appropriate policy effect for automatic remediation of Azure Backup on virtual machines.
Identify DeployIfNotExists (DINE) as the correct effect because Azure Backup requires deploying helper resources (such as backup policies and association resources) that do not exist on the target VM resource itself.
DINE enables automated deployment of missing dependent resources, satisfying the requirement to enable backup automatically.
2
Identify the correct exclusion mechanism for the legacy workload scope.
Add the resource ID of the rg-legacy resource group to the notScopes property of the MG-Production policy assignment.
The notScopes property prevents the policy from evaluating any resources inside the specified scope, eliminating policy overhead and administrative complexity for exemptions.
3
Select the policy effects for VM SKU control and SQL auditing compliance.
Choose Deny for VM SKUs in MG-Development and Audit for SQL database auditing in MG-Production.
The Deny effect prevents deployments of non-compliant VM sizes immediately, while the Audit effect reports non-compliance of SQL database auditing without blocking or auto-remediating.

Anahtar Kavram

Azure Policy effects and assignment scope exclusions
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Azure Policy Governance

Bu konudan daha fazla soru